save-context
Warn
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill automatically performs a
git pushof the generated context snapshot if the storage directory is identified as a git repository. This behavior transmits potentially sensitive conversation data (including goals, decisions, and file paths) to a remote server without a separate user confirmation step for the network operation. - [COMMAND_EXECUTION]: The skill executes shell commands (
git add,git commit,git push,cd) to manage the saved context files. It utilizes the$ARGUMENTSvariable to define filenames without explicit sanitization, which presents a surface for command injection if the platform does not provide inherent protection. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the processing of conversation history.
- Ingestion points: Full conversation history (SKILL.md).
- Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the conversation history being analyzed.
- Capability inventory: File system writes to multiple directories, shell command execution, and network transmission via
git push. - Sanitization: Absent; the content extracted from the conversation is interpolated directly into the markdown output template.
Audit Metadata